User access management (UAM) lets administrators control who can access an account and what they can do — whether you manage your own account or client accounts as a Channel Partner. Every account has its own users, roles, and environment configurations, so a well-designed access model ensures each team member has the permissions they need and nothing more.

> 📘  
> **Applies to**:  
> Channel Partners, their client accounts, and direct customers. The v2 model — custom roles, roles assigned per environment, and access scoped to use cases — works the same way in each environment.

## Users, Use Cases, Roles, Permissions

User access management is built on a few related concepts:

```
User
Use Case
Role
Environment
Sandbox
Production
Permissions
```

1. A **user** is a person with a name, email, and optional phone number.
2. Each user is assigned to one or more **use cases** — the business scenarios (for example, KYC, fraud detection) the user works with.
3. For each use case, the user is assigned one or more **roles**. Roles can be system-defined (built into RiskOS™) or custom (created by your organization).
4. You can toggle each role independently for **Sandbox** and **Production** environments. A user can have broad access in Sandbox for testing and restricted access in Production.
5. Each role grants **permissions** across eight categories, each set to No Access, View Only, or Full Access.

### Sandbox and Production environments

RiskOS™ maintains completely separate user and role configurations for Sandbox and Production:

| Aspect               | Behavior                                                                                   |
|----------------------|--------------------------------------------------------------------------------------------|
| **User lists**       | The Users page shows a different list depending on whether you select Sandbox or Production. |
| **Role assignments** | A user can have different roles in each environment. For example, full workflow access in Sandbox but view-only in Production. |
| **Independence**     | Changes to Sandbox roles do not affect Production roles, and vice versa.                   |

> ⚠️  
> **Important**:  
> Always verify which environment you are viewing before making user or role changes. The environment selector at the top of the Users page controls which list you see.

### Permission categories

Roles grant access through eight permission categories. You can set each category to one of three levels:

| Permission Category       | No Access               | View Only              | Full Access                        |
|---------------------------|-------------------------|------------------------|------------------------------------|
| **Roles**                 | Cannot see roles        | Can view roles         | Can create, edit, and delete roles |
| **Users**                 | Cannot see users        | Can view users         | Can create, edit, and delete users |
| **Batch Jobs**            | Cannot see batch jobs   | Can view batch jobs    | Can create and manage batch jobs   |
| **Documentation**         | No access to docs       | Can view documentation  | Full documentation access           |
| **PII Access**           | No PII visibility       | Can view PII data      | Full PII access                     |
| **Reports**               | Cannot see reports      | Can view reports       | Can create, edit, and delete reports |
| **Custom File Uploads**   | Cannot upload files     | Can view uploads       | Can upload and manage files         |
| **Workflows**             | Cannot see workflows    | Can view workflows     | Can create, edit, test, and deploy workflows |

## System Defined Roles

RiskOS™ provides **system-defined roles** as pre-built starting points for common permission sets. System-defined roles:

- Cover common access patterns out of the box.
- Cannot be edited or deleted.
- Cannot be inspected in an edit view — to understand what one grants, compare user behavior against the permission categories above.

Use system-defined roles as baselines before creating custom roles. For the full list of role types and how they appear in the Roles tab, see [Roles & Permissions](https://help.socure.com/riskos/docs/cp-roles-and-permissions#system-defined-vs-custom-roles).

## Custom Roles

When a system-defined role does not fit your needs, create a **custom role** with permissions tailored to a specific job function. Custom roles:

- Are created by your organization.
- Let you set each of the eight permission categories independently (No Access, View Only, or Full Access).
- Can be edited and deleted.

To create, edit, or delete a custom role, see [Roles & Permissions](https://help.socure.com/riskos/docs/cp-roles-and-permissions#create-a-custom-role).

## Add and Manage Users

Add users to an account, then assign each one the use cases and roles they need — separately for Sandbox and Production.

- **Add a user** — enter the user's details, select their use cases, and assign roles per environment. See [Manage Users](https://help.socure.com/riskos/docs/cp-manage-users#add-a-user).
- **Edit or delete a user** — update a user's details or roles, or remove their access. See [Manage Users](https://help.socure.com/riskos/docs/cp-manage-users).
- **Assign roles per environment** — give a user different roles in Sandbox and Production. See [Assign Roles](https://help.socure.com/riskos/docs/cp-assign-roles).

## In this section

| Task                                          | Article                                                      | Estimated time               |
|-----------------------------------------------|-------------------------------------------------------------|-------------------------------|
| Create, edit, or delete a user account       | [Manage Users](https://help.socure.com/riskos/docs/cp-manage-users)  | 5–10 minutes per user       |
| View permission categories, create or delete custom roles | [Roles & Permissions](https://help.socure.com/riskos/docs/cp-roles-and-permissions) | 5–15 minutes per role         |
| Assign or change a user's roles per environment | [Assign Roles](https://help.socure.com/riskos/docs/cp-assign-roles) | 5 minutes per user            |
| Review access governance guidelines and audit checklists | [Access Governance Best Practices](https://help.socure.com/riskos/docs/cp-access-governance) | 15–30 minutes (initial review) |